Information Management Assessment

Action plan progress review

Department of Health

Reviewed June 2016

Published April 2017

Working with government to raise standards in information management Background to this report

The Information Management Assessment (IMA) programme is the best-practice model for government bodies wishing to demonstrate commitment to the principles of good information management.

The Department of Health IMA took place in 2014. We conducted interviews at the department’s London and Leeds offices between 13 and 24 October 2014. The IMA report is published on The National Archives’ website.¹

This progress review summarises key developments since the IMA. It is based on a high-level summary of developments since the IMA provided to us shortly before the progress review meeting in June 2016, together with evidence supplied by the department.

Commentary on engagement

Following the IMA, the Department of Health established an information governance group with a view to taking forward work to address the report. The then permanent secretary published a statement committing to developing and implementing an IMA action plan, however none was produced.

At the time of review, we saw limited evidence of concerted joined-up action by key stakeholders to address the risks highlighted. As a consequence a number of key aspects of our recommendations had not been addressed, as highlighted in the body of this report.

Areas where continued attention is still needed are listed below under ‘Next Steps.’

¹ http://www.nationalarchives.gov.uk/information-management/manage-information/ima/ima-reports-action-plans/ Progress to address recommendations and risk areas

1 The value of information

| Performance rating | IMA 2014 | Review 2016 | |--------------------|----------------|---------------------------| | Communicating and realising value | Satisfactory | Progress not maintained | | Managing information as an asset | Development area | Development area |

Situation at the time of the IMA

The Department of Health’s Information Management Policy clearly conveyed the importance of information to the organisation. It was linked to the business strategy and endorsed by the Permanent Secretary.

The ICT Strategy had an information management component around the rollout of the department’s SharePoint system, Information Workspace (IWS). There was also a draft IWS strategy, though this had not been officially adopted. The Department of Health needed to ensure that an information strategy and vision for 2015 onwards was signed off at Board level with an agreed schedule for reporting so that progress in delivering benefits could be monitored and challenged. It needed to prioritise improving and embedding Information Workspace (IWS) and enabling routine records creation and disposal. We wanted the strategy to provide impetus for effective lifecycle management, protection and exploitation of information across all repositories. It needed to cover culture and governance as well as technical considerations.

The Department of Health required its Divisional Heads, as Information Asset Owners (IAOs), to record any significant information assets on the Information Asset Register (IAR) and conduct risk assessments on them. There was no single definition of an information asset or clearly expressed criteria to support their identification. Only a basic level of detail about each information asset was recorded on the Information Asset Register. We recommended that the Department of Health reviews how information assets were defined and logged, and how owners were allocated. This needed to be done to increase understanding of the information for which the department has responsibility and to help the department to manage, protect and exploit it more effectively. Existing structures did not give coverage to the broad groupings of unstructured information within key corporate repositories such as IWS and the shared drives.

We were given verbal assurance that the strategy was signed off following the IMA. Limited progress has been made in achieving the strategy’s overall aim of establishing IWS as the sole repository for current digital information. The Department of Health has not embedded relevant strategic goals within a broader information management vision as we recommended.

The DH 2020 vision and supporting DH Way Task & Finish Group (TFG) have enabled a corporate focus on knowledge-related issues. However, in the absence of an agreed overarching set of information-focused objectives, the Department of Health has lacked the impetus to address core issues such as information management culture. This includes the specific risk areas of email-related behaviours and continued reliance on shared drives.

An Information Asset Owner handbook has now been produced. This is based on the template adopted by many IMA programme members. It has been tailored to reflect the department’s own processes and provides the standard open and inclusive definition of an information asset, as promoted by Cabinet Office and The National Archives.

While this in itself is positive, the new definition does not yet appear to be referenced in other documentation such as the information management policy and guidance on managing information risks. As such, it does not yet appear to be consistently promoted to the organisation, raising the risk that it will be interpreted differently in different areas of the business. While the IAO Handbook notes the need to have retention and disposal schedules in place, key considerations such as disposal are still not covered by the Information Asset Register, which has not been amended or developed since the IMA. An opportunity has been missed to reference the Departmental Records Officer (DRO) and the central information management team among the key roles that IAOs need to be aware of.

2 Digital information and supporting technology

| Performance rating | IMA 2014 | Review 2016 | |-------------------------------------|-------------------|------------------------------| | Supporting information through technology | Development area | Development area | | Digital continuity and IT change | Development area | Progressing towards satisfactory |

Situation at the time of the IMA

IWS had the potential to provide a supportive environment for information and records management. Records were not yet routinely being declared within IWS and disposal had not yet been enabled within the main shared resources area where records of short, medium and long-term value should be stored.

The shared drives held more information and were growing more rapidly than IWS. These were not subject to central oversight or control and did not support disposal. There were also longstanding issues relating to the management of email. It was felt that size limits on email inboxes were driving staff to delete emails in bulk or transfer them in bulk to IWS without considering their value. We highlighted a number of potential risks relating to the email archive that the Department of Health planned to introduce to help improve the situation. We recommended that guidance on how systems need to be used should be refreshed and promoted, noting that encouraging adherence to core principles should be a key component of the department’s overall strategic approach for its information. The Department of Health held a significant amount of legacy digital information, but was not planning to ensure its digital continuity. The department lacked understanding of the digital information stored across all repositories. We emphasised the need for a plan for migration from the legacy Electronic Records and Document Management system (EDRMs) MEDS and highlighted that plans should also encompass information held in the shared drives and Primary Care Trust (PCT) and Strategic Health Authority (SHA) records.

The status of IWS was described as fragile at the time of the formal progress review and it is clear that a number of technical problems with the system remain. It has still not been mandated and the shared drives are still in use. This remains a significant concern and one that the department has not defined the impact of (see below).

A project to replace IWS with SharePoint online is due to start and the aim is to maintain the system until the change takes place. The Department of Health will need to manage the risk that staff will continue to lose faith in IWS in the interim and increasingly use alternative areas such as shared drives and Outlook to store their information. A further consideration is that take-up of SharePoint online may be undermined by the fact that its look and feel will not be substantially different to IWS.

The department has sought to ensure that access restrictions are applied in a more proportionate way within IWS. A new policy has been written on the application of access restrictions within IWS with the aim of ensuring a more open approach. Management Committee approval was sought for this. Local Folder Managers (LFMs) were due to be engaged to help identify necessary exceptions. We were told that LFMs have now been given the power to reject unnecessary requests to restrict access.

As noted above, email remains a significant issue for the Department of Health and staff are reportedly still dumping significant volumes of email into the IWS file plan to free up their inboxes. One folder in IWS was recently identified that contained 56,000 emails. Email archiving is still being considered as a possible solution, but in the short term, the department is hoping to mitigate the situation by temporarily extending mailbox capacity to 1GB. While this has the potential to relieve the pressure on staff, we emphasise that doing this without an accompanying focus on improving the way staff use and work with email may simply defer the problem until inbox size limits are reached again.

The Department of Health has encountered a loss of digital continuity in relation to digital PCT and SHA records, the metadata of which has been found to show the date of saving or scanning rather than the date of creation. However, we note that a more active approach is now in place for the mitigation of digital continuity risk. A project has been set up to consider the future of the bespoke and customised MEDS system. A key driver for this is the need to decommission the Lotus Notes based infrastructure before the move to a new IT contract in 2018. A number of potential solutions have been identified in discussions with the department’s current supplier.

The Department of Health has now used The National Archives’ free file profiling tool, Digital Record Object IDentification (DROID), which it has run on sample collections. One member of staff in the records management team has also now been given access to all of the department’s shared drives. In a recent exercise to analyse content, records were found dating back to 1989. Under the 20 year rule, any such information with historic value selected for permanent preservation would be due for transfer in 2016.

3 Information risk, governance and oversight

| Performance rating | IMA 2014 | Review 2016 | |--------------------|----------|-------------| | Recognising information risk | Development area | Development area | | Establishing control | Satisfactory | Satisfactory | |----------------------|--------------|--------------| | Providing guidance | Development area | Progressing to satisfactory | | Measuring impact | Good practice | Progress not maintained |

**Situation at the time of the IMA**

Despite some positive work around information risk, the department had not yet fully defined the potential impact of poor performance in information and records management. Its overall approach to information risk prioritised information security with a focus on the potential loss of personal data. It also prioritised risks within Arm’s Length Bodies.

We recommended that the department should formally articulate the risk at all levels of a failure to capture or keep the information it needs, in line with its value. We emphasised that the Senior Information Risk Owner (SIRO) should be sighted on this risk and that the department needed to know in what ways, and how successfully, it was being mitigated. To help support this, we recommended that the relationship between the SIRO and the DRO should be defined.

To help deliver better governance, the Department of Health needed to review current provision of information-focused boards. This was needed to help support long-term planning and increase oversight at an operational level.

The well-established network of LFMs was playing a key role in ensuring the effective operation of IWS. We recommended that the draft LFM performance objective should be made mandatory and built into the performance evaluation framework. The means by which LFMs supported IAOs needed to be clarified.

No mandate was provided on the use of IWS and there was no clear policy line on the purpose of the shared drives. We identified a gap in terms of provision of guidance to staff to help them understand in practice what information has value and how it needs to be managed as a consequence. Promotion of the principles of good information management needed to be a key component of the department’s new information strategy.

An internal programme of assessments provided a helpful means of measuring compliance with information management policy and of encouraging good practice. We recommended that results were more widely publicised so that directors, in their capacity as IAOs, could see how their teams were performing. There was no link to separate information risk assessments and the scope needed to be expanded to cover the use of shared drives with greater focus on the practical application of ‘What to Keep’ principles.

The department’s guidance on information risk makes no reference to the role of the DRO or to the information management team. The relationship between the DRO and SIRO has still not been formally defined. Risks relating to the management of information have still not been fully defined. As a consequence, the department continues to lack understanding of the level of risk that information management culture, legacy holdings and current IT environment exposes it to.

The formation of the Knowledge Management Information Governance board offers significant potential benefit to the department. However, we note that it currently has no data, digital or technology representation.

Since the IMA, the LFM objective has been published and promoted. The LFM network continues to be supported by the central information management team. The department has also published its retention and destruction policy on Gov.UK in line with recommendations made in Sir Alex Allan’s 2014 Records Review report. Knowledge capture guidance has also been

______________________________________________________________________

2 [https://www.gov.uk/government/publications/records-review-by-sir-alex-allan](https://www.gov.uk/government/publications/records-review-by-sir-alex-allan) reviewed and refreshed along with guidance on naming and labelling records. A ‘what to keep’ flowchart has been produced which goes some way towards addressing our concerns about the lack of guidance to help staff understand the value of information. A revised top-line endorsement from the previous permanent secretary has been reissued under the Director of Workplace and Transformation. It now explicitly states that information management is integral to DH 2020. Information policy remains centred on the five key principles and now states ‘what to do’ and ‘how to do it’ for each of these.

However, while policy and guidance provision has been improved in a number of areas, we are concerned to note that the Department of Health continues to provide no meaningful steer or enforceable mandate on the use of shared drives. This must be addressed as a priority.

The Department of Health’s internal programme of assessments on information management has been suspended due to departmental restructuring. We were given verbal assurance that the programme will be restarted in April 2017 and that the possibility of aligning this and the risk assessment process has been discussed. There has reportedly been agreement that the results of assessments can be published in the future.

We were told that assessments are still being offered if business areas ask for them; two have been conducted since the programme was put on hold. We have seen no evidence that any wider reporting on information management performance to teams or senior management is taking place.

4 Records, review and transfer

| Performance rating | IMA 2014 | Review 2016 | |--------------------|----------|-------------| | Oversight of records and selection | Satisfactory | Progress not maintained | Implementing disposal decisions

| Satisfactory | Satisfactory | |--------------|--------------|

**Situation at the time of the IMA**

The Department of Health had a good track record in the appraisal, preparation and transfer of paper records. Although not due to transfer digital records until 2020, it needed to develop a plan and approach for the appraisal, selection and sensitivity review of digital information.

In addition to the 19 million digital records inherited from PCTs and SHAs, the Department of Health had also inherited almost 475,000 boxes of paper records. These were managed alongside the department’s own records under the NHS Code of Practice and were thought unlikely to be transferred to The National Archives. However, they still needed to be factored into the department’s plans for records in all formats in view of their potential impact on its continued ability to meet the transition timeline for the 20-Year Rule.

Records were being disposed of from MEDS but disposal was not enabled within the shared drives or shared resources area of IWS. The Department of Health needed to enable disposal within IWS and define how it would be applied to information within its shared drives.

The Penrose Evidence Inquiry records were one of The National Archives’ first business as usual digital transfers, and the first involving redacted records. Although these were not born-digital records, the central information management team told us that it has gained useful experience in developing a process of appraisal, selection, sensitivity review and transfer for digital records.

There is recognition that existing manual processes of appraisal will not work in a digital context and we were told that the DRO is seeking to upskill the review team accordingly. Retention periods have now been identified and applied to IWS and closure dates will act as the trigger point for disposal. These have still not been activated, partly due to the Independent Inquiry into Child Sexual Abuse (IICSA) and partly due to a lack of confidence that staff are saving information in the right place within IWS. While progress has been made in understanding the age of information, the department still lacks understanding of their value or the amount of time they need to be retained for.

The Retention and destruction policy still states that the records management team has no responsibility in relation to the disposal of information assets and for disposal within shared drives. This does not reflect the fact that:

- all information created in government is managed through the provisions of the Public Records Act and related legislation
- the DRO leads on departmental compliance with the Public Records Act

While disposal may be conducted by teams or members of staff, the DRO assumes overall responsibility and must ensure that appropriate measures are in place.

The Department of Health has engaged with the Archive Sector Development department at The National Archives on the potential impact of the 20-year rule on material inherited from PCTs and SHAs. Some paper legacy has already been sent to local archives, although plans for the remainder are as yet unclear.

The Department of Health identified an backlog of 6338 pre 1988 records in the autumn 2016 RTR that were still to be reviewed. These have now been placed under a retention instrument in order to be compliant with the Public Records Act. The department states that it intends to discuss how best to

______________________________________________________________________

3 [http://www.nationalarchives.gov.uk/information-management/manage-information/planning/departmental-record-officer/role-departmental-record-officer/](http://www.nationalarchives.gov.uk/information-management/manage-information/planning/departmental-record-officer/)

12 review legacy digital records held in MEDS with its Information Management Consultant. It also plans to identify how best to weed out low value material in order to make sensitivity review easier. Next Steps

The National Archives will continue to work closely with the Department of Health so that it is supported as it continues its work on information and records management. A plan needs to be established to take forward the following points relating to key recommendations and risks that have not yet been addressed.

Priority issues:

- To support and enable DH2020 and the DH Way, and the forthcoming expected move to SharePoint online, establish an information management strategy that sets goals for current and legacy information in all locations.

  - As originally recommended this should provide direction for improvements to information and records management culture. The Welsh Government’s work in improving records management and email handling is a good practice model.

- Establish a plan for information held in the shared drives, including migration of information, disposal of information and decommissioning of the drives. The importance of doing so is underlined by the age of the information and its vulnerability to accidental or unauthorised alteration, copying, movement or deletion

  - As a first step, it must define for staff the purpose of the shared drives and provide an enforceable mandate on their use.

- Define and communicate the risk of not capturing or keeping information in accordance with its value so that it can be addressed at all levels of the department – the role of the DRO must be established within governance arrangements

- Devise a plan and approach for the appraisal, selection and sensitivity review of digital information.

  - It must ensure that adequate plans are in place that balance the demands of appraisal and sensitivity review work with other pressures. The DRO’s responsibilities should be extended to encompass the shared drives and disposal of information assets.

- Review how information assets are defined and logged, and how owners are allocated.

  - It should also ensure that the definition of an information asset is consistently applied in practice and established consistently in linked documentation
  - Engage with The National Archives train the trainer programme for IAOs

The Department of Health must also:

- Ensure data, digital and technology representation on the Knowledge Management Information Governance board to enable joined up planning
- Formally establish how compliance with policy will be monitored and ensure that monitoring extends to management of digital information in all locations and application of what to keep schedules as recommended in our original 2014 report.